@madauth/server 0.3.0-beta.2 → 0.5.0-beta.1

package/dist/store/dynamodb.d.ts

@@ -1,5 +1,5 @@
 import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
-import { S as StoreAdapter } from '../schema-3yhCc2jH.js';
+import { S as StoreAdapter } from '../schema-BTgDj1Xn.js';
 
 interface DynamoDbAdapterOptions {
     /** The table, with the partition key `pk` and the sort key `sk` (both strings). */

package/dist/store/sqlite.d.ts

@@ -1,4 +1,4 @@
-import { S as StoreAdapter } from '../schema-3yhCc2jH.js';
+import { S as StoreAdapter } from '../schema-BTgDj1Xn.js';
 
 /**
  * Stores madAuth's records in a SQLite file using Node's built-in `node:sqlite` (Node 22.13 or newer).

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { S as StoreAdapter } from './schema-3yhCc2jH.js';
+import { S as StoreAdapter } from './schema-BTgDj1Xn.js';
 
 /** The parts of a test runner the contract needs; Vitest, Jest and node:test with `expect` all fit. */
 interface ContractRunner {

package/dist/testing.js

@@ -13,8 +13,10 @@ function testUser(overrides = {}) {
     name: null,
     sessionVersion: 0,
     lastMailAt: 0,
+    lastSmsAt: null,
     wrongCodes: 0,
     claims: null,
+    signedUpAt: null,
     createdAt: 17e11,
     ...overrides
   };
@@ -29,6 +31,11 @@ function testAccount(overrides = {}) {
     failedAttempts: 0,
     lockedUntil: 0,
     email: null,
+    lastUsedStep: 0,
+    setupId: null,
+    phone: null,
+    primaryUserId: null,
+    secondFactor: null,
     createdAt: 17e11,
     ...overrides
   };
@@ -115,6 +122,20 @@ function storeAdapterContract(t, createAdapter) {
       expect(await store.findOne("account", { key: account.key })).toEqual(account);
       expect(await store.findOne("account", { key: unique("password:missing") })).toBe(null);
     });
+    it("lets many records leave a unique field empty, but refuses a value that is taken", async () => {
+      const store = await createAdapter();
+      const userId = unique("usr_contract");
+      const first = testAccount({ userId, key: unique("totp:contract") });
+      const second = testAccount({ userId, key: unique("sms:contract") });
+      const primary = testAccount({ userId, primaryUserId: userId });
+      const another = testAccount({ userId, primaryUserId: userId });
+      expect(await store.create("account", first)).toBe(true);
+      expect(await store.create("account", second)).toBe(true);
+      expect(await store.create("account", primary)).toBe(true);
+      expect(await store.create("account", another)).toBe(false);
+      expect(await store.findOne("account", { primaryUserId: userId })).toEqual(primary);
+      expect(await store.findOne("account", { id: another.id })).toBe(null);
+    });
     it("sets a field to a value and to null", async () => {
       const store = await createAdapter();
       const user = testUser({ name: "Ada" });

package/dist/{user-BMWEWREH.d.ts → user-yoGjrw4k.d.ts}

@@ -7,6 +7,11 @@ interface MadauthUser {
     picture?: string;
     /** What admins attached to the user, e.g. `{ roles: ['admin'] }`. Absent without claims. */
     claims?: Record<string, unknown>;
+    /**
+     * How this session was authenticated (RFC 8176): `pwd` (password), `google`, `github`, `otp` (the
+     * authenticator app, on its own or as the second factor), e.g. `['pwd', 'otp']`. Present on a user that comes with a session.
+     */
+    amr?: string[];
 }
 
 export type { MadauthUser as M };

package/dist/verify.d.ts

@@ -1,5 +1,5 @@
 import { JWTVerifyGetKey } from 'jose';
-import { M as MadauthUser } from './user-BMWEWREH.js';
+import { M as MadauthUser } from './user-yoGjrw4k.js';
 
 interface SessionVerifierOptions {
     /** The madAuth server's public base URL (its MADAUTH_ISSUER). */

package/dist/verify.js

@@ -2,7 +2,7 @@ import {
   SESSION_COOKIE,
   SESSION_TYP,
   userFromClaims
-} from "./chunk-DCDTO5LG.js";
+} from "./chunk-A7UYZRBL.js";
 import {
   SIGNING_ALG
 } from "./chunk-JDQLSL36.js";

package/dist/{webhook-j5u9Kv9l.d.ts → webhook-DlmfG_kS.d.ts}

@@ -1,5 +1,8 @@
-/** Every `type` madAuth sends. */
-declare const WEBHOOK_TYPES: readonly ["email.verify", "email.reset", "email.already_registered", "email.no_password", "signup.before", "user.created", "email.verified", "email.password_reset", "user.signed_in", "user.deleted", "user.claims_changed"];
+/**
+ * Every `type` madAuth sends: `email.send_*` and `sms.send_*` hand over a message to send, `user.signing_up`
+ * asks whether someone may sign up, and the other `user.*` types tell what happened.
+ */
+declare const WEBHOOK_TYPES: readonly ["email.send_verification", "email.send_password_reset", "email.send_signin_link", "email.send_already_registered", "email.send_password_reset_no_password", "sms.send_code", "user.signing_up", "user.signed_up", "user.email_verified", "user.password_reset", "user.signed_in", "user.deleted", "user.claims_changed", "user.second_factor_enabled", "user.second_factor_disabled", "user.recovery_code_used"];
 type WebhookType = (typeof WEBHOOK_TYPES)[number];
 /** How old a call may be before receivers reject it, so a captured call can't be replayed. */
 declare const WEBHOOK_TOLERANCE_SECONDS: number;

package/dist/webhook.d.ts

@@ -1 +1 @@
-export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-j5u9Kv9l.js';
+export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-DlmfG_kS.js';

package/dist/webhook.js

@@ -4,7 +4,7 @@ import {
   generateWebhookSecret,
   signWebhook,
   verifyWebhook
-} from "./chunk-3QRKWLR7.js";
+} from "./chunk-SISM7YUZ.js";
 export {
   WEBHOOK_TOLERANCE_SECONDS,
   WEBHOOK_TYPES,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@madauth/server",
-  "version": "0.3.0-beta.2",
-  "description": "madAuth server: Google and e-mail & password sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.",
+  "version": "0.5.0-beta.1",
+  "description": "madAuth server: Google, e-mail & password and authenticator-app sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.",
   "license": "MIT",
   "author": "David Neuy",
   "homepage": "https://github.com/inouiw/madAuth#readme",
@@ -88,6 +88,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.1.3",
+    "@zxcvbn-ts/core": "4.2.0",
+    "@zxcvbn-ts/language-common": "4.1.3",
     "hono": "^4.13.12",
     "jose": "^6.2.12"
   },

package/dist/chunk-CD7Y4T66.js

@@ -1,62 +0,0 @@
-// src/store/schema.ts
-var madauthSchema = {
-  version: 4,
-  models: {
-    /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
-    user: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        email: { type: "string" },
-        emailNormalized: { type: "string", unique: true },
-        emailVerified: { type: "boolean" },
-        name: { type: "string", nullable: true },
-        sessionVersion: { type: "number" },
-        lastMailAt: { type: "number" },
-        /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
-        wrongCodes: { type: "number" },
-        /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
-        claims: { type: "string", nullable: true },
-        createdAt: { type: "number" }
-      }
-    },
-    /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
-    account: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        userId: { type: "string", index: true },
-        key: { type: "string", unique: true },
-        secret: { type: "string", nullable: true },
-        failedAttempts: { type: "number" },
-        lockedUntil: { type: "number" },
-        /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
-        email: { type: "string", nullable: true },
-        createdAt: { type: "number" }
-      }
-    },
-    /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
-    verification: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        userId: { type: "string", index: true },
-        purpose: { type: "string" },
-        codeHash: { type: "string" },
-        attempts: { type: "number" },
-        expiresAt: { type: "number" }
-      }
-    },
-    /** A setting admins change at runtime, as JSON (since version 4), e.g. `methods`: which sign-in methods are on. */
-    setting: {
-      fields: {
-        id: { type: "string", primaryKey: true },
-        value: { type: "string" },
-        updatedAt: { type: "number" },
-        /** The address of the admin who set it; empty when set from the command line. */
-        updatedBy: { type: "string", nullable: true }
-      }
-    }
-  }
-};
-
-export {
-  madauthSchema
-};